Mirrors/opencv
0
0
Fork 0
mirror of https://github.com/opencv/opencv.git synced 2026-01-18 17:21:42 +01:00
Code Packages Releases Activity

Prevent integer overflow in dimension checks.

Browse Source 
This fixes https://g-issues.oss-fuzz.com/issues/446726230
This commit is contained in:
Vincent Rabaud
2025-12-16 12:51:19 +01:00
parent c03734475f
commit 5c6c584c01
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
modules/imgcodecs/src/grfmt_png.cpp
View File

@@ -42,6 +42,7 @@
#include "precomp.hpp"
#include <cstdint>
#include <memory>
#ifdef HAVE_PNG
@@ -364,7 +365,7 @@ bool PngDecoder::readHeader()
m_color_type = color_type;
m_bit_depth = bit_depth;
if (m_is_fcTL_loaded && ((long long int)x0 + w0 > m_width || (long long int)y0 + h0 > m_height || dop > 2 || bop > 1))
if (m_is_fcTL_loaded && ((int64_t)x0 + w0 > m_width || (int64_t)y0 + h0 > m_height || dop > 2 || bop > 1))
return false;
png_color_16p background_color;
@@ -456,7 +457,7 @@ bool PngDecoder::readData( Mat& img )
if (dop == 2)
memcpy(frameNext.getPixels(), frameCur.getPixels(), imagesize);
if (x0 + w0 > frameCur.getWidth() || y0 + h0 > frameCur.getHeight())
if ((uint64_t)x0 + w0 > frameCur.getWidth() || (uint64_t)y0 + h0 > frameCur.getHeight())
return false;
compose_frame(frameCur.getRows(), frameRaw.getRows(), bop, x0, y0, w0, h0, mat_cur);